Paul Uhrig and Eddie Qureshi on How Health Systems Adopt AI and Protect Patient Data

Paul Uhrig and Eddie Qureshi look at hospital AI from opposite sides of the contract. Uhrig is a healthcare lawyer and digital health executive. He was the first chief legal officer at Bassett Healthcare Network, a rural health system in upstate New York, and later its Chief Legal and Digital Health Officer, after 14 years at Surescripts. Qureshi is founder and CEO of Rainfall Health, which builds AI to help hospitals manage Medicare’s TEAM model, including the 30 days after surgery. Uhrig also advises Rainfall, a connection Qureshi noted during the conversation.

The threat closer to home

Lori Ellis opened with recent reports of AI being used by bad actors. Uhrig took them seriously, then pointed somewhere closer. In the shorter term, he said, the bigger cybersecurity risk is ordinary criminals with better tools, the kind behind the polished fake-recruiter messages now landing in his own inbox. “I don’t think we can lose sight of the shorter term threat of how AI is also enabling the truly bad guys with bad intent.” Vendors, he added, have to think about how their own systems plug in. The wider industry has felt the pressure this year, with three large healthcare companies disclosing cyber incidents within about two months in 2026.

Qureshi said security comes up in every executive conversation he has, whatever the title across the table. “Cybersecurity compliance is always top of the list.” He borrowed an aviation comparison he once heard about healthcare: no one would accept a plane that lands safely 99 percent of the time. “You have to try to get it 100% of the time and you’re always striving for it.”

What executives ask before they buy AI

Asked what is on an executive’s mind when an AI platform is pitched, Uhrig started with return on investment. “What is the problem that is being solved?” Then how the improvement will be measured, and the change management it needs for clinicians, staff and patients.

The data questions follow. “How is the data being used? Is it being used to train the models? Should it be used? What are the constraints?”

Why AI pilots fail to scale

The question health systems that implement well ask from the first meeting, Uhrig said, is what the end game is. “People often talk about a pilot and then don’t really think about okay if the pilot is successful what is the workflow required to roll it out at scale.” Pilots tend to start with the evangelists. Scale brings in the people who did not volunteer, and with them more resistance.

The result is a pilot that succeeds on its own criteria with no plan or capacity to roll it out. “It frustrates the health system. It frustrates the vendor who is selling that to them.” It rhymes with why government AI projects tend to fail on funding rather than technology, where temporary money launches a program that nothing pays to sustain.

A narrow problem and a short sales cycle

Over seven years Qureshi’s company moved from rural health, working with Indigenous communities and veterans, to something much narrower. “We work on managing episodes of care for Medicare patients.” His market is the set of hospitals in Medicare’s TEAM model, which CMS lists at 716, and he estimated the people he sells to at about 1,500 executives nationwide. Awareness varies widely: he described a CFO who had not heard of the model eight months into operating under it.

He said his average sales cycle now runs under three weeks, which he credits to an AI that solves one specific near-term problem and proves its return. The rule he works by is that an executive can only carry two or three priorities at once. “So if you’re not one of those top three priorities, no matter how great your AI is, it’s just not the right solution.”

Uhrig asked whether systems look alike from the vendor side. Qureshi said personalization matters, but “the struggle is all the same,” and his answer is a pricing promise: “Let’s align incentives. If I don’t help provide value to you as a health system with my AI, well, you don’t have to pay me.” Every system, he said, comes back to one question: “How do we do these things but do them sustainably?”

Patients bring AI into the exam room

Patients are now running their symptoms through ChatGPT and Claude, and Lori Ellis asked what that does to the conversation with a provider. Uhrig marked the shift after two decades of work on patient access to data. “Now that patients can connect their medical records to LLMs like Claude and ChatGPT, I think it really has changed the conversation.” A clinician told him patients once arrived with symptoms, then with whatever Dr. Google had told them. Now they come with better questions about their care, and sometimes with a proposed plan of care.

That can produce a better informed, more engaged patient. It can also lock a patient into a plan the physician would not recommend. Uhrig said health systems should prepare for it, have the conversation rather than challenge the patient, and even reconsider how long an encounter needs to be. The gap between digital adoption and access is a thread from an earlier episode with a hospital CIO and a community advocate on why patients still struggle to reach their doctor.

Outside HIPAA

When a patient puts their records into a consumer AI tool, Qureshi said, the starting point is that the patient is a consumer. “Ultimately it’s the patient’s choice.” Patients can get a product delivered in hours and still wait months for their own health data, and he said they notice.

Uhrig explained what changes legally. Many patients have some familiarity with HIPAA, “but this information goes outside of HIPAA.” Outside it, he said, the governing rules are the Federal Trade Commission’s and some state laws, so protection depends on what the vendor represents about how it uses the data. Then the honest problem: “We all click through the consents in these apps.” He asked how to put those terms in plain English instead of 30 pages, and who will enforce them. Many vendors, he said, are upfront and comply; the bad actors are why enforcement matters. Data that leaves its original setting can matter beyond the individual too, as an earlier conversation on why anonymized clinical data sets still carry value to a state actor explains.

The 30 days after surgery

Lori Ellis turned to a use of AI the show rarely covers: the patient who goes home from surgery and spends 30 days calling a nurse whenever a temperature moves. Qureshi said Medicare’s policy sets the ground rules and defines success, but leaves open the operations, investment and infrastructure needed to reach it. Under the CMS TEAM model, selected hospitals coordinate care from surgery through 30 days after discharge for five procedures, starting in 2026.

The application he said gets the strongest response from both health systems and patients is an AI care coordinator that, by his account, speaks 76 languages. “My grandmother could just pick it up and start speaking in the language that she’s familiar with and it could help her on the first ring.” The patient gets one point of contact instead of guessing whether to call the surgeon or the family physician, and the conversation lands in the record in the clinician’s language so a human can step in. He estimated that most of the time a patient needs information and advocacy rather than an intervention, which leaves the humans time for the cases that need them.

Why ambient listening stuck

Uhrig cited figures he had seen putting AI use at about 85 percent of health systems, starting with administrative work and moving into clinical care. Ambient listening took hold fastest. It listens to the conversation between clinician and patient, separates the speakers, and drafts the note and the structured fields in the medical record. The problem it solved was visible to everyone: clinicians typing through the visit, or catching up at night in what was called pajama time.

For the clinicians who adopted it, he said, “it allowed them to focus on their patient during the encounter.” The clinician still has to review the note for accuracy and approve it before it enters the record, the same human check that sits behind who carries responsibility when AI-generated data turns out to be wrong. “They also could stay in control, right?”

A family legacy, and a bet on one Medicare model

Qureshi’s path into healthcare is a family one. His grandmother was one of the first female physicians in Pakistan, and his mother still practices in a rural part of Arkansas, where patients drove four or five hours for continuity of care. His hardest decision was narrowing the company to one Medicare model years before it took effect. “We bet everything on it three years before we knew it was going to see the light of day.”

Uhrig stayed in healthcare law for the complexity and the innovation. His hardest stretch was starting at the health system during COVID, and he said the field should learn from it so it is prepared if it happens again.